What stays on your device
- Your textThe pad, your history, your dictations and their audio, and your dictionary are files in the app's data folder. scratchcat never uploads, syncs or copies them anywhere.
- SettingsA readable file beside your text. It holds no keys.
- Provider keysKept in your system's own credential store: Credential Manager on Windows, Keychain on macOS, the Secret Service on Linux. On a device without one, they go in an encrypted file in the data folder, and Settings says so. A key is used only to talk to its provider, and you can remove it in Settings.
- Grammar and spellingChecked inside the app by Harper, offline. Nothing is sent.
- Dictation on your deviceThe Parakeet model turns speech into text on your device. The audio and the text stay there.
- Repair on your deviceThe Qwen3 4B model runs on your device's graphics card, in English only. It sends nothing.
There is no account, no sync, no advertising, and no analytics or telemetry of any kind. I cannot see what you write, how often you use it, or that you use it at all.
How long it is kept, and how to remove it
Settings decides how much history and how many recordings are kept: a number, an age, forever, or not at all. You can delete anything in History yourself.
Everything lives in one folder. A copy from the Microsoft Store keeps it inside its own package, and Windows removes it when you uninstall. A direct download keeps it in%APPDATA%\dev.scratchcat.app on Windows,~/Library/Application Support/dev.scratchcat.app on macOS, or~/.local/share/dev.scratchcat.app on Linux. Delete that folder to remove it all. Keys in the credential store are removed in Settings, or undercom.basepurpose.scratchcat in the store itself.
What leaves, and only when you choose it
Cloud dictation. Off unless you choose a provider instead of dictating on your device. Today that provider is OpenAI. The audio of each dictation, and the language you set, go to them with your own key, and their privacy terms and charges apply.
Cloud repair. Off unless you choose a provider: OpenAI, Anthropic or xAI. When repair runs, the text being repaired goes to them with your own key, along with any words from your dictionary or history that appear relevant to it, so they are spelled the way you spell them. Their privacy terms and charges apply.
In both cases there is no server of mine in between. The request goes from your device straight to the provider, over an encrypted connection, so I never see the audio or the text.
Repair uses generative AI
Repair, on your device or in the cloud, is done by a language model. It can be wrong: it may change a word you meant or miss a mistake. Its changes land in the pad where you can see them, and one undo reverses a repair, so read the result before you send it. If repair produces something harmful or offensive, write to basepurpose.com@gmail.comwith whatever of it you are happy to share.
Problem reports
Settings has Report a problem. A report is sent only when you press Send, and you can see what goes before it goes. It contains:
- what you wrote in the description, and your email if you give one for a reply;
- device details: the app's version and where it came from, the operating system and its version, the processor, its core count, memory, your language and region setting, and the graphics card if the local repair check has run;
- how dictation is set up (on your device or which provider, the model, the language) and your other settings, without your microphone's name;
- the last 200 lines of the app's own log, which records what the app did and not what you wrote, with your home folder's name removed;
- up to three screenshots you choose to add, with your own words replaced by bars before the image is made.
Never your pad, history, dictionary or transcripts. Reports go to my server at basepurpose.com, which uses your IP address only to limit how many reports can arrive, and are kept privately to find and fix the problem. If you are offline, a report waits on your device and sends later. One that still has not gone after 30 days is deleted.
What the app itself contacts
Model downloads. When you download a dictation or repair model, it comes from models.basepurpose.com (my storage, at Cloudflare) or Hugging Face, with a copy on GitHub as a fallback for some. Those servers see your IP address, as any download does. Every file is checked against its known fingerprint before it is used.
Updates. A direct download asks basepurpose.com whether a newer version exists, at launch and every six hours. The request carries nothing about you or your device beyond the IP address every request has. An update downloads only when you choose it, and its signature is checked before it installs. A copy from the Microsoft Store is updated by Microsoft and makes no such request.
Licences. On the Microsoft Store, Microsoft runs the trial and the purchase, and the app asks Windows whether this copy is bought. I receive no payment details. A direct download counts its trial on your device, with no network. When direct sales open, a licence key comes from Dodo Payments: activating it sends the key to Dodo once, and Dodo returns the name and email it was bought with, which the app keeps to show whose licence it is. The app then checks with Dodo now and then that the key is still valid. None of this involves your text.
What I hold, and your rights
Almost nothing. I hold the problem reports you send, the emails you write to me, and, once direct sales open, the licence records Dodo keeps for a purchase. I do not sell or share any of it, and no one else sees it except the services named on this page. You can ask to see, correct or delete anything I hold about you by writing tobasepurpose.com@gmail.com, and I will answer within 30 days. Under India's Digital Personal Data Protection Act, 2023, basepurpose is responsible for what it holds, and that address is also where to raise a grievance. You can also complain to your data protection authority.
Children
scratchcat is not made for children: anyone under 13, or under the higher age the law where they live sets (16 in much of Europe, 18 in India). I do not knowingly hold anything about them. If you think a child has sent me something, write and I will delete it.
This website
This site sets no cookies, runs no analytics and loads nothing from any other site. The film plays from here. The server that sends you these pages sees your IP address, as every website's does. Links to the Microsoft Store, and later to a Dodo Payments checkout, take you to them, and their privacy terms apply there.
Changes and questions
If this page changes, the date at the top changes with it. Questions go tobasepurpose.com@gmail.com. scratchcat is made by basepurpose.